skysight-inc/HackerNews huggingface dataset:
There are all kinds of uses for social engineering.

We should not be surprsised not all of the are pleasant.

Nor should we be surprised, that some are more (or: less) transparent than others.
> I'm not sure if my tolerance for snarky, dipshit comments like this has gone down lately, or if there are a lot more snarky dipshits on this site now.

there are, I just spotted one.
1985 Playboy interview with Steve Jobs
The Interplanetary Medium
So, the training I got when I worked as a cashier way back when must have been a fluke, even though it was with one of the largest retail companies in the country.
> Facebook has TREMENDOUS lock-in. For any new place to have value, it's got to have the majority of the people Facebook has
> Facebook's value IS lock-in

How can a website lock you in to only being able to share things with your friends through their website? Do they lock you out of your friendships if you quit the site? This is a very bizarre notion to me. Facebook accounts have no value, the people behind the accounts and the relationships have the value. Facebook disappearing wouldn't prevent you from communicating with them. Is this real life?

> and companies with real technical prowess will fail because they rely on producing something new

Err, what? Do you mean that smart people working on hard problems are destined to fail? That facebook has some how consumed all of the available users and prevented them from existing any where else on the internet?
all i can think about is chris farley "living in the van down by the river"
Great Idea, although to realy archive terabytes with a relatively small dropbox account you'd have to do it in 10-100 steps.. Recovering it via dropbox would be even more challenging.
ICloud: Extended complimentary storage for former MobileMe members
I'd love to see some concrete suggestions on the right way to do security for a site like this. This would take far more than protecting a few web pages from unauthorized access. What else should they do? How should they store sensitive data like AWS keys? Should they include a feature to force the creation of a new temporary key to prevent users from naively storing their master key? Is there a better mechanism than storing the key?
Luckily you can rotate keys even for the root level accounts.
If you want something cheap to fool around with, there is:

http://nosupportvpshosting.com/

I just set up a VPS there to try out. No idea on reliability yet, but it does seem like a lot of (virtual) server for the money.
Is it ethical to use this form of mind control? Who decides how you should be reprogrammed?
Totally not the same thing. Not even close. Knowing a tracking number is nothing compared to having access to someone's AWS account. That's like saying knowing where someone's car is parked is the same as having their keys and a full tank of gas.

I agree with silhouette. These guys scaffolded a rails project and and then slapped bootstrap on it. You can't trust an MVP this extreme.
It's not a credit card company control, it's a merchant control to limit liability.

Having worked in loss prevention in the past, I know that the intent is to make sure these controls are checked an maintained. The issue you run into with cashiers is that the turn over rate is usually so high, or those checks aren't done frequently enough that the controls become lax.

Why would merchants be so concerned with these controls, you might ask? Because if it can be proven that the charges were made fraudulently, the merchant becomes responsible for them. If someone buys $300 of stuff from a store using your credit card, the store loses that cash.
Yeah, that bit was weird -- it implies a contrast in maturity and scale between North America and Europe that seems not to have basis in fact. Germany's largest bikeshare system, per Wikipedia, only has 3,000 bikes, which is smaller than Montreal's. Even DC's, currently the largest in the US, is on the same order of magnitude, at ~1700 bikes, and is a well-established system at this point (over two years old, with somewhere around 2.5 million rides so far).
That's very interesting, can you provide any more detail?
Mac OS X Mountain Lion and ColdFusion 9: connecting Apache and Jrun
That template used to be very popular -- pessimism feels cool, doesn't it? -- but it lost a lot of credibility when spam filters got really good. I hardly ever get spam anymore.
I'm not a supporter of the war on drugs. I have known a large number of recreational ketamine users because of my time in the rave scene, and I'm just pointing out the nature of the substance. I also have prescriptions to held manage ADD and depression so I'm supportive of more research in this field, not less.
ryan's info is public. he put it on our feedback forum. i wanted to make sure everyone was aware of his public info since we (as well as others) were very concerned with his course of action and questionable statement "Still managed to get a few dozen AWS keys though."

i'm not sure why thanking him is in order... ?

5 people emailed me privately about the security issue. we fixed it promptly, and followed up with instructions to everyone exposed (~20) on how to protect their credentials. i haven't yet heard a complaint from our actual users.
Yeah, I guess my reply was kinda snarky. The simple fact is that every time sound didn't work out of the box on a Debian-based system (especially Ubuntu), removing pulseaudio was all that was needed to fix it.
Show HN: apple-doc: get Apple Development Document easily
This script is written to help you get access to documents from ADC(Appple Dev Center) easily and keep them up to date.
True, but people aren't in the habit of tying on tourniquets for fun on a Saturday. Or maybe they are these days, I don't get get out as much as I used to.
Jacksonville Jaguars vs Chicago Bears live stream watch here NFL online
Jacksonville Jaguars vs Chicago Bears live stream watch here NFL
online football Regular season 2012 Week 5 and also enjoy full season
Match scheduled: Date: SUN, OCT 7 2012 Time: 4:05 PM (ET) NFL Regular
season 2012 Week 5 venu: EverBank Field,Jacksonville Jaguars vs
Chicago Bears live stream watch here NFL online,Jacksonville Jaguars
vs Chicago Bears live stream watch here NFL online,Jacksonville
Jaguars vs Chicago Bears live stream watch here NFL online.
Though it is late, and I've been out at bars with friends, I made this for you:

http://dzoba.com/?p=182
No, no. Don't get me wrong. I wasn't trying to be needlessly combative. Misuse of "begs the question" and "could(n't) care less" used to be similar hobby horses of mine.

Once something reaches a critical mass, however, it becomes futile trying to set it right. You might want to avoid discovering too much about Confucius and/or Yogi Berra for your own sanity.

http://xkcd.com/386/
This is a great critique of Brett Victor's "Learnable Programming" essay. Weird to see it not getting any attention here.
Evolution: Making Sense of Life
> - After installing Apache, change the following in httpd.conf: ServerToken -> Prod, ServerSignature -> Off, KeepAlive -> Off
>
> - After installing PHP, edit php.ini to make it shut up: expose_php -> Off

What is the purpose of this? Security by obscurity? Or being really frugal about header length?
> The problem with having your code all in a software image is that the second you do this you lose a large existing toolset that people have invested a lot in mastering.

Intersystems Caché.

There's a CACHE.DAT, which sits on the filesystem as a giant monolithic file. It's just a big block device containing a B-tree. In some nodes of that B-tree you'll find binary code. There are specialised tools to manage all this. In other nodes you will find data. There are specialised different tools to manage all this.

There is the one virtual machine and it only runs one language fairly well, called MUMPS. There is an object-oriented addition to it. It's basically a huge bunch of macros that compiles down to... MUMPS.

You can, in a hackish way, sometimes call specific functions from a DLL but that's as far as it gets. However, effectively...

No libraries. At all. And that's the biggest pain.

No libraries. I want you to let that sink in. All those things on Github and SourceForge and everywhere you, simply put, can't use.

No libraries. Except the few that the vendor, Intersystems, chooses to eventually let you have... with often broken functionality. There will never be any UI toolkit or Javascript interpreter or HTML engine or nice XML parser or any of those things. There is a crappy JSON parser, but that's about it in terms of recent niceties, and it's only there because some other customer would have paid for it.

No libraries. And that's the biggest problem with these software image things.

No libraries.

The biggest advance that we managed to get in was installing hooks in the proprietary source code editor (no vim or choice of text editor here) to export and import the code from disk. On save and load. It helped a lot to be able to get all the classes into actual files that we could use SVN with and made things so so much easier.

Software images might be a good idea in theory.

But in practice, you are throwing out your file browser, your text editor, your libraries and everything, everything, else.
Foxconn's iPhone plant "paralyzed" as thousands strike
Facebook Stories: We Are All Daniel Cui
It's a Rails application and it does reflect the structure. It's the edit action on a controller, likely the UsersController. It looks like they tried to implement a user management system using has_secure_password and didn't know enough to do it properly.

They therefore created a default resource structure (probably using the rails scaffold generator command) which includes the id in the URL on all member routes, including the route for the edit action.
Naked-eye, even.
Logan Airport replacing X-ray body scanners with millimeter-wave scanners
Simple yet brilliant. I love the simple design and clean user experience. Emailing me when I've checked in with my boarding pass is extra nice as well. Well done, Nikil!

I was just buying a Southwest ticket and was complaining about having to remember to check in when I found this site. It made my day.
It just so happens that I have the very best test site possible for this argument: one of my alpha customers has a website built by Not-A-Professional with an incredible 156 requests and 2.39MB of data for the landing page. It is exactly the opposite of an optimized website.

So I tested the page load with KeepAlive on and KeepAlive off. I `/etc/init.d/apache2 graceful`'d before each test, and I cleared Chrome's cache before each test. I have nothing else running on my system right now and our pipe is nice and clear. I have a 92ms ping from the office to my web server.

KeepAlive On: 5.31s

KeepAlive Off: 6.87s

1.5 seconds is an appreciable difference. It works out to roughly 10ms per request, unless it's so late that the math part of my brain has quit for the night. If Yahoo.com were loaded from my web server, having KeepAlive on would delay total page load by about 750ms -- a noticeable difference. (However, given that it takes over 4 seconds to reach page load on yahoo.com for 70+ requests, their page might actually load faster if it were hosted on my server...)

Now here's the kicker: that same customer site has been featured on a popular radio show, twice, driving over 6 million hits over 24 hours, with peak traffic at 40Mb/s, thousands of simultaneous connections, and 100+ requests per second, sustained for several hours.

The site's loading time during that period was utterly unaffected. Seriously, never even a blip. (I stayed up during the whole period just to personally watch it.)

I wasn't about to experiment with turning on KeepAlive during all that fun, but I'm reasonably confident that having KeepAlive turned on would have crushed that server, given that my customer's site was receiving substantially more traffic than even Pinboard did immediately after the Delicious announcement (http://blog.pinboard.in/2011/03/anatomy_of_a_crushing/) -- traffic that Pinboard's founder notes will usually kill an unprepared site (or server).

And keep in mind, this was all on a memory-constrained tiny little vm.

So here's my final statement on KeepAlive, which I will link back to from now on: if, as a server admin, you're turning KeepAlive on to speed up your site, then you are optimizing your server and your site in exactly the wrong way.
And he clearly is a very interesting man - http://newsimg.bbc.co.uk/media/images/47370000/jpg/_47370392...

Context: http://news.bbc.co.uk/2/hi/science/nature/8535938.stm
http://i.imgur.com/gVbiw.jpg
It's available DRM free from Baen for $4.00: http://www.baenebooks.com/p-921-lucifers-hammer.aspx.

(I have no affiliation, other than being a happy customer).
I was slightly sympathetic to them right up until smeagle posted RKearney's email. While not noticing an incredibly obvious security hole is serious, it's somewhat understandable in the context of a site that unintentionally goes public before it's ready. What's far, far worse is the mindset in which someone who points out a security hole is the problem, and should be personally attacked.

They should have thanked him, notified their users, done a thorough review of their own security, and warned new signups to only use IAM keys. Instead they got defensive, made excuses, and attacked the messenger.
Comets don't reflect light, they generate it moving against solar wind and radiation. After those things are left behind it becomes a just a big ol' flying rock again.
I imagine that our descendants will have a certain kind empathetic pity on us for not knowing this for certain in the same way we look back on people not knowing what atoms were.
I used to see this exact same issue (wrong timezone selection) on some phpBB spammers. They all chose GMT-12:00, which contains no permanently inhabited landmasses. Easy block. :)
Here's a current one, but there are a great many more papers on the subject if you hit Google Scholar or suchlike: http://schizophreniabulletin.oxfordjournals.org/content/earl...

However, the specific condition I was thinking of is 'Olney's lesions' (overview: http://www.camtriplehelix.com/journal/issue/3/breathing-in-t...). It should be noted that some critical research has been withdrawn in this area, which I had missed, so that raises questions about the accuracy of my original remarks: http://www.erowid.org/chemicals/dxm/dxm_health1.shtml
What's not very clear to me is if my Glacier files are a subset of my Dropbox files, or a separate datastore.

I only have 2GB of Dropbox space because I never upgraded. But I have about 100GB of archive data I'd probably throw into Amazon Glacier if it were convenient.

Do I need to open a 100GB Dropbox account before using IceBox?
One appropriate way to do this is to not build this type of application as a web service, but instead as a standalone application. (Disclaimer: I haven't really tried this product, for obvious reasons.)
At first, I thought I was supposed to notice the complete lack of "HTTPS" in the URL bar.

The data leakage obviously overshadows it, but I can't think of a site that wouldn't be a better "fit" for SSL encryption than an app like this, aside from banking/government sites.

SSL might have been a "nice-to-have" back in the day when there were real arguments to be made against it (mostly performance-related), but even those don't really apply to a "pet project" made by "two nerds" (smeagol's words, not mine.) And for an app like this, I think it's critical.

Just my two cents.
The scale of the universe
RAR has a built in virtual machine for forwards compatibility with new compression algorithms.
Yep, security by obscurity. AKA, the exact same reason that people move ssh to other ports.

If it turns out that there is some kind of exploit floating around for a specific version of Apache or PHP, and if jackasses are looking for vulnerable servers by first looking at the server headers instead of just randomly targeting servers, then I want mine to be totally useless to them so that they (hopefully) just move on to some other poor schmuck's server.

Security-by-obscurity is only a problem when you depend on it, or when you are using it to cover up some kind of serious stupidity, like totally untested crypto. There's nothing wrong with using it to frustrate and annoy adversaries.
Oh man. Can't wait. I'm totally keeping my calender clear on 75,787.
Great example of why building an app != a startup. You should email all users, and post a public apology on your site or blog.
> Since this argument only takes into account commodity hardware and not instruction set improvements (e.g., ARM 8 specifies a SHA-1 instruction), [...] the need to transition from SHA-1 for collision resistance functions is probably more urgent than this back-of-the-envelope analysis suggests.

So the ARM 8 SHA-1 instruction contributes to making itself obsolete? :-)
Not sure what the parent is referring to, but back in the day you'd have porn preview galleries with no index, but with an easily enumerable id in the URL. Ah, youth...
Carbon Bicycle Rims
I would guess he means that the data is encrypted before ever being sent to backblaze. The answer is yes according to http://www.backblaze.com/backup-encryption.html

Rather, it's an optional yes.
Call me old fashion, but I'll save $150 and leave a key under the mat.
Yes. This the entire way. Fuck everything about this situation, christ. Thank god I didn't sign up.
If you were a company, you'd have insulation against lawsuits. Two nerds mean you and your family's assets are at risk; launching an app with such a spectacular security hole seriously puts the two of you and your families in danger.
I'm a big fan of responsible disclosure, and I think that the HN crowd has far too much of a one-track mind about "always disclose security problems everywhere!", especially with something that may not have been ready for release.

But that "contact Ryan if anything goes wrong" is grade A asshole.
> It was also a demonstration that the people running the business have absolutely no idea what they are doing when it comes to security, privacy, or testing and release processes.

I'm pretty sure a lot of successful startups were started by people who had "absolutely no idea what they were doing". Give them a break...
Memorializing Steve Jobs
Ha! I remember that book. I memorized several end-of-the-world survival strategies from it. Like "you can drive a jeep on railroad tracks" and "when packing for the apocalypse, don't forget liquor."
Responsive Framework Comparison
Will she ever return? No, she'll never return.
What knowledge we will learn!
She'll voyage forever in the inky blackness.
She's the probe who'll never return.

To the tune of "Charlie on the M.T.A.":

http://www.mit.edu/~jdreed/t/charlie.html
Regarding keep-alive: yes, it will lead to memory issues when it's on and you use mod_php and the prefork MPM (which you really have to with mod_php). But this is just one configuration. You can easily fix it by either of:

- use php-fpm and switch to any other MPM in apache

- keep using mod_php but put an nginx or other reverse proxy before apache. It will do the keep-alive and you can configure apache to still close it's connections.

- use nginx and php-fpm directly

All will mitigate the memory issue while still allowing you to offer keep-alive
Oxymoron Entertainment CEO History 
Historical note on The CEO of Epassporte aka Oxymoron Entertainment. More info here http://oxymoronentertainment.blogspot.com
Little Bird
Actually it has. See Kellogg's 6 hour day
Yeah, if we couldn't do business with people who ever released software with security holes, none of us would have jobs.

The big fuck-up is when they told anyone with key problems to contact the guy who found the issue. That's why we should consider them unprofessional. The security holes were accidents. The blamestorm was deliberate.
>Why is this an invalid approach?

Because of information theory. It's believed that the binary expansion of pi contains all possible finite bit sequences. A program that expands pi is relatively small. Assuming that hypothesis is true, does that mean we could write a compressor that simply breaks input into blocks and then encodes the output as indexes into pi?

And the answer is that we certainly could write that program. And the result would almost always be a larger output than input. Why? Because you'd have to search so far into pi that the index would contain more bits than the input blocks. In short, having a library of arbitrary strings to draw from does not help you to compress data.

More generally, compression is impossible in the general case. Every lossless compression algorithm will, on average, produce an equal or larger output than its input.
I wonder what sarcasm looks like in hieroglyphics.
What do you call the role of the individual whose job it is to implement account management? Do you not call that person an engineer? If not - whose responsibility would you say it is to ensure shit like this doesn't happen?
Ah right, I totally missed the fact that compression by 1 bit doesn't beat the challenge!
could you recommend a video card for 3 monitors?
I think prefork/mod_php is still the default setup, and it's a really good one to get away from right away if you plan on handling any serious traffic.

Using nginx/php-fpm is great, so long as you don't need support for Apache-style .htaccess files. Since I'm adminning a shared hosting environment, I can't give up support for .htaccess files; if you intend to only host your own site, and your site doesn't need that, then by all means please use nginx & php-fpm, you'll save yourself a lot of headaches.

Setting up an nginx proxy seems like kind of a cheat in a discussion about tuning Apache -- "how to tune Apache: 1. don't tune Apache, set up nginx proxies instead..." -- but suffice it to say that setting up proxying nginx servers is on my to-do list.

I have not yet though had a traffic-related site outage (see also http://news.ycombinator.com/item?id=4619906), so it's not as high on my list as things like "recurring payments system". :-)
It is curious that the wiki mentions Voyager I data for some claims and we use those to verify Voyager I data?
I actually thought about it some time ago and even started working on a prototype, got dropjar.com for that, but after seeing how low companies like backblaze sell unlimited backup for ... I figured it's a hard sell.

Good luck with icebox.
Another good option for photo backup is to sign up for a flickr pro account. $45 for 2 years unlimited storage.
Maybe if you talked to some white people, instead of making assumptions about them, you'd realize many of them notice the subtle racism, same as you.

EDIT: That being said, other than your claim that only minorities notice subtle racism, I agree with everything else in your post. Well spoken and laid out.
Facebook is about events. It will always be valuable as long as it remains the center of the entertainment industry for finding out about when the next party or show is.
I love this -- it's always fun to think about what aspects of our modern science people will one day scoff at.

Some I always consider:

- Cures for disease

- Our understanding of space

- Transportation
Not everybody agrees that Moore's law will continue, see for example "Dark silicone and end of multicore scaling"

http://dl.acm.org/citation.cfm?id=2000108

ftp://ftp.cs.utexas.edu/pub/dburger/papers/ISCA11.pdf

They use existing data to model CPU perofrmance increase and conclude with "Through
2024, only 7.9 average speedup is possible across commonly used parallel workloads, leaving a nearly 24-fold gap from a target of doubled performance per generation."
>If you just have to decompress a single file, I don't see why this problem is impossible since you can tune your decompressor to that file.

It isn't guaranteed to be impossible; it's just very, very likely to be impossible.
Predicting the future through online data mining
9 Metrics to Help You Make Wise Decisions about Your Start-Up
Change Columbus Day to Exploration Day
Salva el Ártico | Greenpeace